Deleting a leaked Git secret is not enough—rotate the credential
Summary
The article demonstrates that deleting a file, rewriting Git history, or deleting a repository may leave leaked secrets accessible. It recommends revoking and replacing exposed credentials, then checking for signs of prior misuse.
Key points
- The article says LiteLLM’s post-mortem described an administrative key committed to a public repository; the key was reportedly used months later to obtain a GitHub token and ship a malicious release.
- Deleting a file in a later commit does not remove the secret from earlier Git history, which secret scanners can still inspect.
- The article demonstrates that a rewritten history may leave commits retrievable from GitHub by their commit hash.
- Deleting a repository may not remove copies retained in forks.
- The recommended response is to revoke the exposed credential, issue a replacement, and update systems that used the old one.
- After rotation, review credential usage logs, recent commits, CI configuration changes, and pipeline runs; treat the exposure as an incident if misuse cannot be ruled out.
Article Details
- Defense Focus
- Detect exposed credentials in source code, Git history, and developer-machine files, then rotate credentials and investigate possible prior misuse.
- Detection Methods
- Scan current code and, when enabled, full Git history, including deleted files.
- Use known credential patterns and generic-secret detection techniques.
- Check whether supported leaked credentials are still active.
- Use IDE extensions and pre-commit hooks to warn before secrets are committed, and block CI/CD builds or pull requests containing secrets.
- Scan local developer-machine files, including shell history, for hardcoded secrets.
- Data Sources
- Current repository code and full Git history
- Credential usage and access logs
- Commits to main and protected branches
- CI and workflow configuration changes and recent pipeline runs
- Local files on developer machines, including shell history
- Rule Types
- Known credential-pattern and generic-secret detection
- Platforms
- GitHub
- GitLab
- Bitbucket
- Azure DevOps
- Defensive Actions
- Immediately revoke exposed credentials, issue replacements, and update every place the old credentials were used.
- Do not rely on deleting a file, rewriting Git history, or deleting a repository to secure a leaked credential.
- After rotation, review credential usage and access logs, recent commits, CI/workflow changes, and pipeline runs for signs of prior misuse.
- If prior misuse cannot be ruled out, treat the exposure as an incident.
- Enable full Git history scanning and use pre-commit, IDE, and CI/CD secret checks.
- Use device scanning to look for hardcoded secrets on developer machines.
MITRE ATT&CK
T1078 · Valid AccountsAccording to the article, attackers used LiteLLM's exposed administrative key to compromise its infrastructure.T1195.002 · Compromise Software Supply ChainThe article says an attacker used the exposed key after more than four months to pull a GitHub token and ship a malicious release.T1552.001 · Credentials In FilesAn administrative key was committed in a file in a public GitHub repository; the article describes scanners finding secrets in Git history and deleted files.
People
Vendors
Products
Aikido Device Protectiona copy. Use Betterleaks or Aikido Secrets Detection to find leaked secrets in your repos, and Aikido Device Protection to find them on developer machines.Aikido Secrets Detectionroutinely scan the internet for secrets, so assume they already have a copy. Use Betterleaks or Aikido Secrets Detection to find leaked secrets in your repos, and Aikido Device Protection to find them on developer
Tools
Betterleaksyou. Attackers routinely scan the internet for secrets, so assume they already have a copy. Use Betterleaks or Aikido Secrets Detection to find leaked secrets in your repos, and Aikido Device Protection to findgitleaksAnyone can run Betterleaks on its own. Aikido sponsors the project, and it’s free under the MIT license. The original author of Gitleaks built it as a drop-in replacement for Gitleaks.